---
id: "CVE-2026-116182"
kind: "vulnerability"
aliases: ["CVE-2026-116182"]
title: "phpMyFAQ: PDF export fetches internal URLs from FAQ images"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "phpmyfaq", "self-hosted"]
not_affected_if: ["fixed-version", "no-pdf-export", "trusted-editors-only"]
published_at: "2026-10-25T14:16:58+00:00"
first_seen_at: "2026-10-25T14:41:23+00:00"
updated_at: "2026-10-25T14:43:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116182", "first_seen_at": "2026-10-25T14:41:23+00:00"}]
---

# phpMyFAQ: PDF export fetches internal URLs from FAQ images

phpMyFAQ before 4.1.10 fetches external images referenced in FAQ answers when generating PDF exports. An attacker who can write FAQ content can point those image URLs at loopback or internal services, so the server requests them and embeds the responses in the generated PDF.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed phpMyFAQ version (`4.1.10` or later is fixed; anything earlier is affected).
- Confirm whether untrusted users can edit FAQ content.
- unknown

## Fix

- Upgrade phpMyFAQ to `4.1.10` or later.
- unknown

## Timeline

- 2026-10-25T14:41:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116182

## From the sources

phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images referenced in FAQ answers. Attackers who can influence FAQ content can embed image URLs pointing to loopback or internal services, causing the server to request them and embed responses in generated PDFs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_